问题

I have the following button:

<input type="button" disabled onClick=document.location.href="?hash=blabla" tabindex="-1" class="btn btn-transparent btn-xs cbut0" />

Now the button is disabled and using another script to re-enable it on mouse-over event, however it seems users can still click the button programmatically by loading a simple external javascript such as:

window.onload = setTimeout(function(){
$('input.btn.btn-transparent').click();
}, 10000);

Is there any way to prevent this behavior, somehow making sure the button is clicked on by a mouse and not by some script?

I found some leads at Disabled button still fires using ".click()" but failed to implement it in my case.

回答1:

You can make use of isTrusted property of event. Have a look at MDN.

The isTrusted read-only property of the Event interface is a boolean that is true when the event was generated by a user action, and false when the event was created or modified by a script or dispatched via dispatchEvent.

Demo

function changeHash(event) {
  if (event.isTrusted) {
    alert("Trusted");
  } else {
    alert("Programmatically triggered");
  }
}

function triggerClick() {
  document.getElementById('btn').click();
}

<input type="button" id="btn" onClick="changeHash(event)" tabindex="-1" class="btn btn-transparent btn-xs cbut0" value="change">

<button onclick="triggerClick()">Trigger click</button>

Below is the sample code to check whether the event is trusted event.

if ('isTrusted' in event) {
  if (event.isTrusted) {
    alert('The ' + event.type + ' event is trusted.');
  } else {
    alert('The ' + event.type + ' event is not trusted.');
  }
} else {
  alert('The isTrusted property is not supported by your browser');
}

So with this code you can change your code like below to get it working.

HTML

<input type="button" disabled onClick = "changeHash()" tabindex="-1" class="btn btn-transparent btn-xs cbut0" />

JS

changeHash(event) {
  if (event.isTrusted) {
    document.location.href = "?hash=blabla"
  } else {
    event.preventDefault();
  }
}

Workaround for `event.isTrusted` is to check for `eventX` and `eventY` properties as shown below

changeHash(event) {
  if (event.screenX && event.screenY && event.screenX != 0 && event.screenY != 0) {
    document.location.href = '?hash=blabla';
  } else {
    event.preventDefault();
  }
}

回答2:

Try this:

<!DOCTYPE html>
<html>
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width">
  <script src="https://code.jquery.com/jquery-3.1.1.min.js"></script>
  <title>JS Bin</title>
</head>
<body>
  <input type="button"  onmousedown="mouseDown()" value="click me" id="btn">
    <input type="button" value="Btn2" id="btn2">
  <p id="prevented"></p>
</body>
</html>

JS:

function mouseDown() {
    alert("MD");
}
$(document).ready(function() {
$("#btn").click(function(evt) {
    evt.preventDefault();
    //prevented click at time:
    $("#prevented").text(new Date());
});

$("#btn2").click(function() {
  $("#btn").click();
});
});

来源：https://stackoverflow.com/questions/42422888/prevent-button-from-being-clicked-programmatically

标签

javascript

button

Prevent button from being clicked programmatically

问题

回答1:

Demo

HTML

JS

Workaround for event.isTrusted is to check for eventX and eventY properties as shown below

回答2:

Workaround for `event.isTrusted` is to check for `eventX` and `eventY` properties as shown below